If that's how they handle email, I wouldn't want to see what they do with payment data.